AIAGENT-001: Copilot agents restrict who can interact (no broad access)
- Platform
- Entra ID / M365
- Category
- AI Agent Governance
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
A Copilot Studio agent whose access-control policy is 'Any' or 'Any multitenant' can be interacted with by any user in the tenant, or by users from any tenant, without restriction. For an agent wired to organizational data and tools, that is an unauthenticated data-access and prompt-injection path. This check flags agents whose access control is set to Any / Any multitenant. When agent data is not collected the result is Not Assessed; a tenant with no agents passes (nothing to govern).
Recommended value
No published agent uses 'Any' or 'Any multitenant' access control; access is restricted to specific authenticated users or security groups
Remediation
In Copilot Studio, open each flagged agent's Security > Authentication and access settings and change the access control away from 'Any' / 'Any multitenant' to authenticated access restricted to your organization (and ideally to specific security groups). Re-publish the agent after tightening access.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| broad | FAIL |
| clean | PASS |
| no-agents | PASS |
| not-assessed | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-3, AC-6, SC-7